Marc's space terminal

Unverified Claims

Sat, 02 Jun 2007 09:52:45 GMT

I've decided to try blogging again on work related stuff, mainly about web service security standards, on a new site, unverifiedclaims.com. Seemed appropriate. I plan to keep this place around to point to stuff that may be "off topic". Basically this will be a venting place as I try to blog more often so I don't have to always censor myself as not being "on topic".

Oh, and for any friends or family reading this who still don't understand what I do we just published a paper I wrote with some colleagues here at Microsoft and at IBM. It's titled "Understanding WS-Federation" and shows the usage of the specification in the title in a variety of scenarios. I'm very proud to have been involved in authoring that paper. I think it does a good job of demonstrating some of the key features of the spec to people familiar with web services but haven't looked at this spec yet. For those of you who are not in this industry it might not help you understand the topic, but it will demonstrate that I actually do work. And that work quite obviously involves typing, drawing pretty pictures and lots and lots of acronyms. :-) I'll post some actual thoughts about this on my new site when I'm not so tired.

Developers fail to care about one sided religious war

Thu, 25 May 2006 23:56:51 GMT

Paul pointed to this interview with Werner Vogels of Amazon about what the developers using AWS care about:

"Do we see that customers who develop applications using AWS care about REST or SOAP? Absolutely not! A small group of REST evangelists continue to use the Amazon Web Services numbers to drive that distinction, but we find that developers really just want to build their applications using the easiest toolkit they can find. They are not interested in what goes on the wire or how request URLs get constructed; they just want to build their applications."

I spend all my time on the SOAP side of this stuff but I agree this is what developers do, and should, care about. My feeling is that SOAP enables better toolkits than REST does. Of course the best you could do is get a toolkit that can handle either.

Nevermind the RESTafarians. You can have it both ways. Drink the kool-aid.

No Urge

Thu, 25 May 2006 22:42:36 GMT

So I was checking out Urge as a potential replacement for Napster. I must say I love the interface of Urge, something I can't say for Napster. The recomendations and latest stuff seems more relevant to em as well despite the overall selection in music seeming pretty equivelant (froma quick scan). Price is identical. They both integrate with WMP11, though Napster seems to only be integratd in the XP version. It hasn't shown up in WMP on Vista as of the last time I looked.

I'm not switching though. Two big reasons.

The first is that Urge doesn't have a Media Center plugin yet. We use Napster on our MCE a lot, particularly for children's music.

The second is that some new music showed up on Napster today. I still can't really believe it.

Napster now has two Nurse With Wound and three Current 93 albums available. All some of their more recent stuff which is great since I have most of the back catalog for each of them. Perhaps they'll turn up on Urge, but if not I'm definitely sticking with Napster.

I'm surprised there wasn't a post at Durtro saying they were trying this out. Hopefully more of their catalog starts to show up here. I expect with the way they release material in stages for their collector fan base that things show up online much later than they first become available. So don't expect to find Black Ships Ate the Sky here any time soon. Off to the record store with me I suppose.

The Nurse with Wound albums available are Salt Marie Celeste and Echo Poeme: Sequence No. 2. The current 93 albums are Halo, SixSixSix: SickSickSick, and Soft Black Stars.

Thought for the day

Wed, 24 May 2006 18:26:44 GMT

Medicine is like security, it's all obfuscation through terminology.

Don't be that guy (EPR version)

Mon, 22 May 2006 22:07:32 GMT

We're dealing with an issue in the RX TC right now related to whether or not we should specify EPR comparrison rules in the RM spec or not. It boils down to people thinking URI comparisson is easy and that they want to mention you can't forget to check ref params in an EPR in addition to the address.

There seem to be a lot of people who want to go down this path but I think they underestimate the complexity of comparing XML. If you doubt how complex that can be I'll refer you to the description of the XPath function deep-equal. The funny thing is as they underestimate the difficulty of comparing XML they completely discount how difficult URI comparrison is. Yet even the spec says there isn't a right answer for comparing uris (see section 5).

Does something need to be in the spec on EPR comparrison? I don't think so, largely for the reasons Jonathan cites here.

If you really think something needs to be in a spec to "help" implementers deal with EPR comparrison how about the following.

"Note: an unscrupulous or uneducated implementer might ignore reference parameters when comparing EPRs. Such an implementer will suffer the economic consequences due to their lack of moral fiber or attention to detail. Don't be this guy!"

It would probably be better to add something to the spec for the spec writers though.

"Note: unscrupulous or uneducated spec writers might try to force implementation choices about optimizations upon other implementers. Such misguided zeal will suffer derision and ridicule for as long as the spec is part of the human "knowledge" base. Don't be this guy!"

What has the internet done for you lately?

Fri, 19 May 2006 18:50:58 GMT

Given you a giant list of 80's music videos you can watch on your computer. Truly a testimate to the massive infringement going on at YouTube, watch them while you can.

Ads by who?

Tue, 16 May 2006 18:35:22 GMT

So I'm now using not only the IE7 Beta but the Office 2007 Beta. One cool thing in this is the shared RSS platform common to each, subscribe in IE and the feed shows up in Outlook and vice versa. Playing with this I'm slowly geting back to reading blogs of the folks I know. One person I haven't been keeping up with much lately is Mark Nottingham who recently left BEA for Yahoo. Yet as I'm catching up with his feed I see ads being provided by a rather odd company given his new employer. It's a funny thing moving from an enterprise focused company to one that has a large consumer focus, it becomes a lot more challenging to eat your own dog food.

Another week in review...

Mon, 15 May 2006 17:03:03 GMT

Somehow I doubt either of these events will be included in Haper's weekly round up so I might as well note them myself. WS-Addressing is now a W3C Recommendation, congratulations to all who helped get there. Jonathan has a lot more to say about this than I do. Last week also marked the 5th Anniversary of ebXML being completed, Klaus-Dieter Naujok marked the occaision with a post noting its demise. I'm being flippant of course, there is much more in his post and it is well worth reading in its entirety.

The Hotel California theory of IT

Fri, 05 May 2006 19:18:17 GMT

Overheard in a meeting today, technology never gets replaced only introduced. Arun Nanda then observed IT is like the Hotel California, you can check in but not out.

The week in review...

Wed, 03 May 2006 20:03:48 GMT

Well I may have neglected to note that WS-Policy was submitted to the W3C last week, but hey Harper's missed it in their round up of happenings from last week as well.

Lots of activity in WS-* space

Fri, 17 Mar 2006 18:10:49 GMT

Jonathon recently posted about some specs that were more like mortar that just got published. These were little things that essentially hooked up older WS technologies into the more current stack that came out of the standards process. Specifically how to bind WSDL 1.1 and SOAP 1.2 and MTOM with SOAP 1.1. Now this week several more specs have just been submitted to the W3C; WS-Transfer, WS-Eventing and WS-Enumeration. You can find an overview of comments from the contributors and the W3C staff from the W3C Member Submision page.

Personally I have little time to keep up with developments like this that swirl around me as I prepare to go to the WS-RX TC F2F and on the heels of that the WS-SX TC F2F. How does that Sandra Boynton song go? “Busy, busy, busy…”

Yes, I obviously have kids. Those of you who don’t probably have no idea what I’m talking about and think Sandra Boynton must be a new DJ.

Choosing not to link

Fri, 10 Mar 2006 16:34:24 GMT

Wow. I just came across a very interesting blog that I am going to choose not to link to. Why? Basically out of concern for the author. You see the person writing it is in a fairly represive country. They make some fairly open statements about how they feel about aspects of living in their country while seemingly taking no action to hide their identity. "They know what they are getting into" I hear you say. I'm not so sure. You see the person in question isn't even an adult.

Now all of that said, perhaps I have a misunderstanding about how the authorities in that country would respond to the sort of critique on this blog. Honestly none of it seemed disrepectful to the country or government to me. They were legitimate complaints that are more the result of how that country has been isolated from the rest of the world.

I hope everything works out for the author of this blog, but like I said I can't help but feel very concerned for them. I guess you could say I'm subscribed.

WS-Policy has been republished

Thu, 09 Mar 2006 19:15:29 GMT

Well today is a big day for WS-*, WS-Policy and WS-PolicyAttachment have been republished by Microsoft, IBM, BEA, SAP, Sonic Software and VeriSign.

The biggest change you ask? Well in my mind it has to be the promotion of the use of nested policy assertions from WS-SecurityPolicy into the core specification. In the previous version of WS-Policy this was a practice that had been discouraged. It was through applying the use of WS-Policy in the domain of security that it was determined that this was actually something important in order to support the great amount of optionallity present within that domain. Specifically there are assertions that have the same subject in WS-SP that would never be used independently and that should affect the intersection algorithm. By nesting them they can then participate in the generic policy intersection algorithm and be evaluated with no need for domain specific processing.

And no I’m not going to provide an example of that right now, maybe later. Or go ask Gudge if you can’t wait.

What is RM good for?

Sun, 05 Mar 2006 16:40:33 GMT

For so long people have incorrectly associated WS-RM with durable and/or queues it is interesting to see a flurry of posts of people realizing it just isn’t so. Dan has the best roundup of posts on this. Paul Fremantle of WSO2, one of the chairs of the OASIS TC I participate in that is standardizing WS-RM, correctly points out that WS-RM is a wire protocol that was never intended to talk about the implementation aspects. It is a mistake to think that WS-RM was intended to solve this in the first place.

So if WS-RM isn’t durable and it isn’t a queue what is it good for?

WS-RM is a wire protocol, which does not dictate implementation details, that applies in two principal scenarios.

Synchronous messaging resilient to communications failures.
Asynchronous messaging resilient to various kinds of failures.

(1) Essentially this is about extending reliability to traditional synchronous web service interactions be they one-way or request-reply. Here synchronous means that both apps, the client and server, are running at the same time and interacting with very low latency.

(2) In the asynchronous case the apps at the client and server are running independently of each other. In this case the apps at either side can potentially be subject to high latencies and can tolerate failure conditions beyond just communication, i.e. the apps may survive reboots. Applications may use a variety of mechanisms to indicate where to send reply messages and how or whether those need to be over a reliable channel. WS-RM could be used for that reliable channel, but it does not speak to aspects like persisting to disc in order to survive potential reboots.

The important thing to remember is that there are no constraints that a WS-RM implementation can’t be durable or a queue, but to assume that it is would be a mistake. The same as it would be to assume that when someone says asynchronous they also mean durable or queued.

If you want more on how WS-RM may relate to queues and/or durable messaging I recommend checking out this post from Shy Cohen.

Spaces upgraded

Fri, 27 Jan 2006 21:28:42 GMT

Mike Torres details the changes to Spaces released yesterday. So far so good, looks like a lot of new stuff to play with. I’m going to have to start trying the photo album stuff for family photos, it looks like most of my concerns from that side have been addressed. This looks like enough stuff in general I’m going to start really playing with my blog again soon. The url to a space is a lot better without “members”, I’ve already updated my mail sigs with that one. Only if there had been a MCE integration piece, that would really get me posting again.

They seem to have done a very good job with this switch. The only hiccups I seen were my quote got pulled into my profile description and posting to the blog from email is a little slow right now and keeps some garbage CSS formatting from Outlook in the post body. Overall, nice work guys. I really am looking forward to playing with these new features.

Search engines and original content

Fri, 27 Jan 2006 20:30:47 GMT

Today I saw an interesting article on the problems search engines have in detecting the original source of content they have indexed in the face of many duplicate sources. The author performed an experiment on Google, Yahoo! and MSN. MSN took the crown, Yahoo! passed as well with results that sounded acceptable to me. Google? Not so well.

I’m not really that surprised, I’ve been using MSN’s search (via IE7’s search box or live.com for a while now and rarely go back to Google anymore, usually only when someone tells me I’d have found better results there for something or other I had problems with at MSN. So far the people telling me that haven’t been right, the search I was running just wasn’t finding much on either site (I have obscure interests so this isn’t surprising).

Actually, maybe about three months ago my wife found something on Google I couldn’t on MSN, but I can’t replicate that experiment now. That was very fortunate because the results of that one led to me becoming the proud owner of a rare Butthole Surfers video directed by Alex Winters. More on that video later, probably after I get into my MCE.

I love my MCE

Wed, 25 Jan 2006 06:59:09 GMT

A few weeks ago I built a Media Center PC. I’ve been having trouble with where to start about how much I love this thing. Why? Well I’m spending my evenings playing with it primarily. I’ll post my build story, config etc. later, for now this is the highlight reel. I expect more on almost everything below as time goes on.

Right now the box is in the living room next to our big Hitachi set. This will be moved to either our office area or the closet once I buy a 360. My existing XBOX has been relegated to the family room to be used as an extender. I even ran cat5 cable to that room so I wouldn’t have to worry about wireless problems, one less thing to troubleshoot. It is simply so cool to be able to access all of our recorded shows, music and photos from either of these rooms. Our bedroom and the guest room where our exercise equipment are up next for this treatment. Something tells me I’m not going to get around to that for months though.

We’ve got some adjustments to make from Tivo as some things are just different, i.e. skip and ffwd behavior as well as remote layout. At this stage I’ve got most of the shows we were recording on Tivo scheduled here. Some new ones too since I installed dual tuners. Recording conflicts are almost non-existent now. We’re keeping the Tivo for one more month, then it’s going to be out of here.

I’m using dCut to edit out commercials and compress shows (sometimes clips) I like for archiving. I think it’s too user unfriendly for handing this task over to my wife, but it works. This is something that frankly I found impossible to do with the Tivo. Yeah, I know you can but it’s too hard.

I’m really loving the music functionality. The visualizations on a big screen set are fantastic, especially with my psychedelic tastes in music. I’ve imported my existing library and ripped everything we got new in the past month or two. This is so much better than having it stuck on a PC and just syncing to an iPod every now and again, very rarely if ever to make it to the stereo. I’ve started ripping our CD library from A to Z, including the discs I hate, something I’ve never attempted to do before. With over a thousand discs that is a big piece of work. I’ve been stuck just past “Beastie” for a week now as the excitement of the project turned into drudgery. I’m tempted to give up and go buy a mega changer that can work with MCE. For now the price on those is prohibitive enough it’s just a fantasy.

I’ve got all of our family photos off the old iBook (soon to be for sale, more later on why) and we’re loving the slideshow feature. It’s particularly great while listening to the aforementioned tunes. I can sit back in my chair by the fire and do light editing (red eye and rotation) with my remote when I spot something that needs correction. This is exactly what I never get around to when sitting in front of a PC.

I’ve also got most of my saved video library on here. Instant access to the Venture Brothers season one, my music video collection and the family movies we’ve taken with our digital camera. Nice, very nice. Getting all of our family movies on DV tape is another future project. That one won’t hurt nearly as much as the CD ripping.

I am drawn like a moth to flame to the online stuff. So far I’m a big fan of TVTonic and Napster. Those two work more consistently and reliably than anything else I’ve spent any time with. Napster has me. Check is in the mail. It’s a little annoying that some tracks are for purchase only there, but the content is deep enough and they have enough good stuff (i.e. Dead Can Dance, Psychic TV, Muslimgauze, etc.) I will be a long time user of this one. The Comedy Central Motherload and MTV Overdrive are brilliant. Unfortunately they are both unstable. It is so hard for me to stay away from the MTV one though. With their deep archive of videos on demand I just can’t help myself. If only these were on Napster. I gave Vongo a quick test, lack of MCE integration is deal breaker though.

Finally, not MCE related but I did install the last.fm plugin (here’s my profile) on that box and my laptop. Thankfully what gets played on the extender in the family room doesn’t get tracked so the Wiggles don’t show up in my profile higher than Current 93 or Nurse With Wound. My son and I do hang out in the living room and he loves the visualization feature that doesn’t run on the extender. So it appears I like They Might Be Giants when I merely find them tolerable. Back when I was young in the late 80’s I could never get into those guys. I now understand it’s because even the songs from back then are really children’s music masquerading as college rock (which I’ve also never been fond of). I’ll have to start suggesting Felix Da Housecat and White Zombie, two of his other favorites, I suppose.

Next WCF Plug-fest announced

Wed, 25 Jan 2006 01:05:35 GMT

Jorgen just posted the details for the next WCF Plug-fest. It will be March 7 to 9 at the Microsoft Campus in Redmond. You can find the invitation to the Pug-fest here. Our endpoints are live, and hey look at that, Kirill got a name (http://mssoapinterop.org/ilab/) for the IP address we had been using.

Hopefully I’ll be able to attend. Unfortunately there might be a conflict with the next WS-RX F2F meeting. Otherwise I’ll be swinging by there myself.

WCF Go Live license and community site available

Wed, 18 Jan 2006 18:00:44 GMT

Excellent, today the Go Live License for WCF and WWF was published. So now there are clear terms for deploying applications built on these technologies in production enviornments.

While that's pretty exciting the community site for WCF came up today. It looks like there are already some pretty cool samples there. There's even a dedicated category for REST and RSS. Amazing. Definitely a site to watch.

WS-SecurityPolicy has been contributed to the WS-SX TC

Thu, 08 Dec 2005 22:07:34 GMT

WS-SecurityPolicy has also been contributed to the TC and yes, there were some discrepancies identified since the July 2005 publication. There is errata version of the spec and a redline document* of the errata against the published version in the contribution to OASIS. Just so you don’t think there is anything hidden there this is a short summary of what the changes are within that errata.

Correcting Appendix C to match WSS, the published version gave advice contrary to WSS
- No schema impact
Addition RequiredDerivedKeys in more assertions
- Already allowed via schema
- Explicitly identifying additional points to provide better security
- Some comments added to schema to indicate these additional points
Removal of some subassertions
- They did not have semantics defined referring to spec versions that did not exist
- An overaggressive cut and paste resulted in this error
- There was a schema impact here to remove some of these
Changed the assertion SC10SecurityContextToken to SC200502SecurityContextToken
- There is no SC10 so the old name is not accurate
- An obvious schema impact here

There was an updated schema included that matches these changes as identified above.

*Note that the redlines are in part two of the contribution as OASIS was never able to fix their email system.